refactor(webhook): give the module a service layer and a typed payload #273
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: ['**'] | |
| pull_request: | |
| branches: [main] | |
| # Read-only by default; no job here writes to the repository. | |
| permissions: | |
| contents: read | |
| # A push to a PR branch matches both triggers, so every job used to run twice; | |
| # superseded runs are now cancelled instead of finishing pointlessly. | |
| concurrency: | |
| group: "${{ github.workflow }}-${{ github.ref }}" | |
| cancel-in-progress: true | |
| jobs: | |
| # The runner entrypoint executes untrusted PR content and was the only code | |
| # in the repo with no linter over it. A shell injection lived there | |
| # undetected; shellcheck is what stops the next one. | |
| lint-shell: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - run: shellcheck infra/docker/claude-runner/entrypoint.sh scripts/*.sh | |
| lint-backend: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: apps/api | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v4 | |
| with: | |
| enable-cache: true | |
| - run: uv sync --frozen | |
| - run: uv run ruff check src/ tests/ | |
| - run: uv run ruff format --check src/ tests/ | |
| - run: uv run mypy src/ | |
| test-backend: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: apps/api | |
| services: | |
| postgres: | |
| image: postgres:16-alpine | |
| env: | |
| POSTGRES_DB: helprs_test | |
| POSTGRES_USER: helprs | |
| POSTGRES_PASSWORD: helprs | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U helprs" | |
| --health-interval 5s | |
| --health-timeout 3s | |
| --health-retries 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v4 | |
| with: | |
| enable-cache: true | |
| - run: uv sync --frozen | |
| # Tests build the schema with metadata create_all, so a broken revision | |
| # chain would otherwise only surface as a crash loop on deploy -- | |
| # production runs `alembic upgrade head` in the container CMD. | |
| - run: uv run alembic upgrade head | |
| env: | |
| DATABASE_URL: postgresql+asyncpg://helprs:helprs@localhost:5432/helprs_test | |
| - run: uv run pytest --cov=helprs --cov-report=term-missing --cov-fail-under=70 | |
| env: | |
| # Test-only values. The ephemeral CI database is destroyed after each run | |
| # and nothing it encrypts ever leaves the job. Do not reuse anywhere else. | |
| DATABASE_URL: postgresql+asyncpg://helprs:helprs@localhost:5432/helprs_test | |
| SECRET_KEY: ci-test-secret-key-at-least-32-bytes | |
| FERNET_KEY: "-fB7lL74GHGbXnRClRQTaBP9_flqSUHFC9_c2n3Tvbo=" | |
| GITHUB_APP_ID: "000000" | |
| ENVIRONMENT: test | |
| lint-frontend: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: apps/web | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: apps/web/package-lock.json | |
| - run: npm ci | |
| - run: npx eslint src/ | |
| test-frontend: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: apps/web | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: apps/web/package-lock.json | |
| - run: npm ci | |
| - run: npx vitest run | |
| build: | |
| runs-on: ubuntu-latest | |
| needs: [lint-backend, test-backend, lint-frontend, test-frontend] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - run: docker build -f infra/docker/Dockerfile.api --target production apps/api | |
| - run: docker build -f infra/docker/Dockerfile.web --target production apps/web | |
| - run: docker build -f infra/docker/claude-runner/Dockerfile infra/docker/claude-runner |